Postflare ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our email platform and related services.
By using Postflare, you agree to the collection and use of information in accordance with this policy.
When you create an account, we collect:
- Email address
- Organization name
- Authentication credentials (managed via our self-hosted authentication system)
- API key metadata (creation date, last used, permissions)
We automatically collect information about how you use the service:
- API call logs (endpoint, timestamp, response status)
- Email sending metadata (sender address, recipient address, timestamp, delivery status)
- Dashboard activity (pages viewed, features used)
We collect technical data to operate and secure the service:
- IP addresses
- Browser type and version
- Device information
- Cloudflare-provided request metadata
- Email body content: Postflare stores the HTML and text content of sent and received emails in Cloudflare R2 so the service can process and display those messages. Email sending uses Cloudflare Email Service; Cloudflare Email Routing is used for receiving email. We do not currently specify a fixed retention period for email content.
- Payment card details: Payment processing is handled entirely by Polar; we never see or store your full payment card information.
We use the information we collect to:
- Provide the service: Process and deliver emails on your behalf, including transactional messages and broadcasts
- Improve the platform: Analyze usage patterns to enhance features and performance
- Communicate with you: Send service notifications, security alerts, and product updates
- Prevent abuse: Detect and prevent spam, fraud, and violations of our Acceptable Use Policy
- Comply with legal obligations: Respond to legal requests and enforce our terms
Your data is stored and processed using the following infrastructure:
- Database: Supabase PostgreSQL. Email metadata, account information, and API log metadata are stored here.
- Object storage: Cloudflare R2 stores email content, attachments, and API request log bodies.
- Compute: Cloudflare Workers, an edge computing platform. Request data is processed in memory and is not persistently stored by the compute layer.
- Encryption: All data in transit is encrypted via TLS. Data at rest is encrypted using provider-managed encryption.
We implement industry-standard security measures including access controls, regular security reviews, and monitoring for unauthorized access.
We use the following third-party services to operate Postflare:
| Service | Purpose | Data Shared |
|---|
| Cloudflare | CDN, Workers compute, Email Service (sending), Email Routing (receiving), R2 storage | API requests, email content, attachments, request log bodies |
| Supabase | PostgreSQL database hosting | Account data, email metadata, and API log metadata |
| Polar | Subscription and payment processing | Billing email, subscription tier, payment status |
Each third-party service has its own privacy policy governing its use of your data.
If you are located in the European Economic Area (EEA), you have the following rights regarding your personal data:
- Right of access: Request a copy of the personal data we hold about you.
- Right to erasure: Request deletion of your account and personal data. Deletion requests are handled on request; email content, attachments, and log bodies stored in Cloudflare R2 are not currently removed automatically when an account is deleted.
- Right to data portability: Request an export of your personal data.
- Right to rectification: Request correction of inaccurate personal information.
- Right to object: Object to specific data processing activities.
- Right to restrict processing: Request that we limit how we use your data.
To exercise any of these rights, contact us at legal@postflare.dev.
Postflare uses a session token cookie to authenticate your dashboard session.
- Account data: Stored in Supabase PostgreSQL. We do not specify a fixed deletion period after an account deletion request.
- API and sending logs: API request log bodies are stored in Cloudflare R2. We do not specify a fixed retention period for logs.
- Email content: Sent and received email content is stored in Cloudflare R2. We do not specify a fixed retention period for email content.
Postflare uses Cloudflare's global edge network, which means your API requests may be processed in multiple jurisdictions. For transfers outside the EEA, we rely on Standard Contractual Clauses (SCCs) and Cloudflare's data processing agreements to ensure adequate protection.
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
- Notify you via email if the changes significantly affect how we handle your data
- Increment the version number
If you have questions about this Privacy Policy or our data practices, contact us at:
Email: legal@postflare.dev